Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
www.fortinet.com
Contents
Contents
Introduction ........................................................................................ 7
About FortiGate SSL VPN ................................................................................. 7
About this document......................................................................................... 8
Document conventions.................................................................................. 8
Typographic conventions........................................................................ 9
FortiGate documentation .................................................................................. 9
Related documentation ................................................................................... 10
FortiManager documentation ......................................................................
FortiClient documentation ...........................................................................
FortiMail documentation ..............................................................................
FortiAnalyzer documentation ......................................................................
Fortinet Tools and Documentation CD ........................................................
Fortinet Knowledge Center ........................................................................
Comments on Fortinet technical documentation ........................................
10
11
11
11
11
11
12
14
14
14
14
14
14
15
15
16
16
17
17
18
Topology........................................................................................................... 18
Infrastructure requirements .................................................................. 19
Configuration overview................................................................................... 20
Configuring the SSL VPN client ..................................................................... 20
SSL VPN Virtual Desktop application. ........................................................ 21
Using the SSL VPN Virtual Desktop ..................................................... 21
Using the SSL VPN standalone tunnel clients...................................... 24
Contents
36
38
38
39
39
40
40
40
40
40
41
46
46
48
48
52
53
54
54
55
Contents
Index.................................................................................................. 85
Contents
Introduction
Introduction
This section introduces you to FortiGate Secure Sockets Layer (SSL) VPN
technology and provides supplementary information about Fortinet publications.
The following topics are included in this section:
FortiGate documentation
Related documentation
web-only mode, for thin remote clients equipped with a web browser only
tunnel mode, for remote computers that run a variety of client and server
applications
When the FortiGate unit provides services in web-only mode, a secure web
connection between the remote client and the FortiGate unit is established using
the SSL VPN security in the FortiGate unit and the SSL security in the web
browser. After the connection has been established, the FortiGate unit provides
access to selected services and network resources through a web portal.
Where users have complete administrative rights over their computers and use a
variety of applications, tunnel mode allows remote clients to access the local
internal network as if they were connected to the network directly. In tunnel mode,
a secure SSL connection is established initially for the FortiGate unit to download
SSL VPN client software (an ActiveX plugin) to the web browser. After the user
installs the SSL VPN client software, they can initiate a VPN tunnel with the
FortiGate unit whenever the SSL connection is open.
When the SSL VPN feature is used, all client traffic is encrypted and sent to the
SSL VPN. This includes both traffic intended for the private network and Internet
traffic that is normally sent unencrypted. Split tunneling ensures that only the
traffic for the private network is sent to the SSL VPN gateway. Internet traffic is
sent through the usual unencrypted route. This conserves bandwith and alleviates
bottlenecks. The split tunneling feature is not enabled by default.
Introduction
Whether to use web-only or tunnel mode depends on the number and type of
applications installed on the remote computer. Access to any application not
supported through web-only mode can be supported through tunnel mode. For
more information about these modes of operation, see Configuring a FortiGate
SSL VPN on page 13.
Working with the web portal introduces the web portal applications and
explains how to work with them. The chapter also explains how to install the
ActiveX plugin and initiate a VPN tunnel when tunnel mode is enabled.
Document conventions
The following document conventions are used in this guide:
In the examples, private IP addresses are used for both private and public IP
addresses.
Caution: Warns you about commands or procedures that could have unexpected or
undesirable results including loss of data or damage to equipment.
Introduction
FortiGate documentation
Typographic conventions
FortiGate documentation uses the following typographical conventions:
Convention
Example
Keyboard input
Code examples
Document names
File content
<HTML><HEAD><TITLE>Firewall
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this
service.</H4>
Menu commands
Program output
Welcome!
Variables
<group_name>
FortiGate documentation
The most up-to-date publications and previous releases of Fortinet product
documentation are available from the Fortinet Technical Documentation web site
at http://docs.forticare.com.
The following FortiGate product documentation is available:
Related documentation
Introduction
Related documentation
Additional information about Fortinet products is available from the following
related documentation.
FortiManager documentation
10
Introduction
Related documentation
FortiClient documentation
FortiMail documentation
FortiAnalyzer documentation
11
Introduction
12
Topology
Configuration overview
Granting unique access permissions for SSL VPN tunnel user groups
13
Authentication differences
IPSec is a well-established technology with robust features that support many
legacy products such as smart cards and biometrics.
SSL supports sign-on to a web portal front-end, from which a number of different
enterprise applications may be accessed. The Fortinet implementation enables
you to assign a specific port for the web portal and to customize the login page if
desired.
Connectivity considerations
IPSec supports multiple connections to the same VPN tunnela number of
remote VPN devices effectively become part of the same network.
SSL forms a connection between two end points such as a remote client and an
enterprise network. Transactions involving three (or more) parties are not
supported because traffic passes between client and server applications only.
Access control
IPSec VPNs provide secure network access only. Access to the network
resources on a corporate IPSec VPN can be enabled for specific IPSec peers
and/or clients. The amount of security that can be applied to users is limited.
14
Web-only mode
Web-only mode provides remote users with a fast and efficient way to access
server applications from any thin client computer equipped with a web browser.
Web-only mode offers true clientless network access using any web browser that
has built-in SSL encryption and the Sun Java runtime environment.
Support for SSL VPN web-only mode is built into the FortiOS operating system.
The feature comprises an SSL daemon running on the FortiGate unit, and a web
portal, which provides users with access to network services and resources
including HTTP/HTTPS, telnet, FTP, SMB/CIFS, VNC, RDP and SSH.
15
In web-only mode, the FortiGate unit acts as a secure HTTP/HTTPS gateway and
authenticates remote users as members of a user group. After successful
authentication, the FortiGate unit redirects the web browser to the web portal
home page and the user can access the server applications behind the FortiGate
unit.
Configuring the FortiGate unit involves selecting web-only-mode access in the
user group settings and enabling the feature through SSL VPN configuration
settings. The user group settings determine which server applications can be
accessed. SSL encryption is used to ensure traffic confidentiality.
Microsoft Internet Explorer 6.0 (or later), Netscape Navigator 7.0 (or later),
Mozilla Foundation/Firefox 1.5 (or later), or Apple Safari 1.3 (or later)
If Telnet/ or RDP are used, Sun Java runtime environment 1.4 (or later), with
Java applet access, JavaScript access, and enabled cookie acceptance
Note: Web browsers offer different SSL security capabilities. The FortiGate unit offers an
SSL version 2 option through the CLI if required to support older browsers. In addition, the
FortiGate unit supports a range of cipher suites for negotiating SSL communications with a
variety of web browsers. The web browser must at least support a 64-bit cipher length.
Tunnel mode
Tunnel mode offers remote users the freedom to connect to the internal network
using the traditional means of web-based access from laptop computers, as well
as from airport kiosks, hotel business centers, and Internet cafs. If the
applications on the client computers used by your user community vary greatly,
you can deploy a dedicated SSL VPN client to any remote client through its web
browser. The SSL VPN client encrypts all traffic from the remote client computer
and sends it to the FortiGate unit through an SSL VPN tunnel over the HTTPS link
between the web browser and the FortiGate unit. Also available is split tunneling,
which ensures that only the traffic for the private network is sent to the SSL VPN
gateway. Internet traffic is sent through the usual unencrypted route. This
conserves bandwith and alleviates bottlenecks.
In tunnel mode, remote clients connect to FortiGate unit and the web portal login
page using Microsoft Internet Explorer, Mozilla Foundation/Firefox, MacOS, or
Linux. The FortiGate unit acts as a secure HTTP/HTTPS gateway and
authenticates remote users as members of a user group. After successful
authentication, the FortiGate unit redirects the web browser to the web portal
home page. The user can then download the SSL VPN client (an ActiveX or Java
plugin) and install it using controls provided through the web portal. SSL VPN
tunnel mode can also be initiated from a standalone application on
Windows/MacOS, and Unix.
16
Topology
When the user initiates a VPN connection with the FortiGate unit through the SSL
VPN client, the FortiGate unit establishes a tunnel with the client and assigns the
client a virtual IP address from a range of reserved addresses. The client uses the
assigned IP address as its source address for the duration of the connection. After
the tunnel has been established, the user can access the network behind the
FortiGate unit.
Configuring the FortiGate unit to establish a tunnel with remote clients involves
selecting tunnel-mode access in the user group settings and enabling the feature
through SSL VPN configuration settings. The firewall policy and protection profiles
on the FortiGate unit ensure that inbound traffic is screened and processed
securely.
Microsoft Internet Explorer 6.0 (or later) with ActiveX enabled, or Mozilla
Foundation/Firefox (1.5 or later) with Java Platform enabled
Note: The browser requirements only apply if you use the tunnel mode client on Windows
through the browser interface. You do not need a browser if you use the standalone tunnel
client.
Note: The user account used to install the SSL VPN client on the remote computer must
have administrator privileges.
Topology
In the most common Internet scenario, the remote client connects to an ISP that
offers connections with dynamically assigned IP addresses. The ISP forwards
packets from the remote client to the Internet, where they are routed to the public
interface of the FortiGate unit.
At the FortiGate unit, you configure user groups and firewall policies to define the
server applications and IP address range or network that remote clients will be
able to access behind the FortiGate unit.
For example, Figure 1 shows a FortiGate gateway (FortiGate_1) to two private
networks, Subnet_1 and Subnet_2.
17
Topology
Remote client
Internet
HTTP/HTTPS
172.16.10.2
wan1
Telnet
172.16.10.3
FortiGate_1
dmz
172.16.10.1
FTP
172.16.10.4
SMB/CIFS
172.16.10.5
internal
192.168.22.1
Subnet_2
192.168.22.0/24
To provide remote clients with access to all of the servers on Subnet_1 from the
Internet, you would configure FortiGate_1 as follows:
Create an SSL VPN user group and include the remote users in the user
group. When you create the user group, you also specify whether the users
may access the web portal in web-only mode or tunnel mode.
For tunnel-mode users, define the virtual IP addresses that the FortiGate unit
is to assign to remote clients when they connect.
Create a firewall policy to allow the SSL VPN user group members to connect
to Subnet_1 through the VPN. For more information, see Configuring firewall
policies on page 45.
If your user community needs access to Subnet_2, you would create a second
firewall destination IP address of 192.168.22.0/24 and create a second
firewall policy that binds the associated remote clients to the Subnet_2 destination
address.
Infrastructure requirements
18
The FortiGate unit must be operating in NAT/Route mode and have a static
public IP address.
The ISP assigns IP addresses to remote clients before they connect to the
FortiGate unit.
If the remote clients need web-only mode access, see Web-only mode client
requirements on page 16.
Configuration overview
Configuration overview
Before you begin, install your choice of HTTP/HTTPS, telnet, SSH, FTP,
SMB/CIFS, VNC, and/or RDP server applications on the internal network. As an
alternative, these services may be accessed remotely through the Internet. All
services must be running. Users must have individual user accounts to access the
servers (these user accounts are not related to FortiGate user accounts or
FortiGate user groups).
To configure FortiGate SSL VPN technology, you should follow these general
steps:
1
Enable SSL VPN connections and set the basic options needed to support SSL
VPN configurations. See Configuring SSL VPN settings on page 36.
To use X.509 security certificates for authentication purposes, load the signed
server certificate, CA root certificate, and Certificate Revocation List (CRL) onto
the FortiGate unit, and load the personal/group certificates onto the remote
clients. For more information, see the FortiGate Certificate Management User
Guide.
Create one FortiGate user account for each remote client, and assign the users to
SSL VPN type user groups. See Configuring user accounts and SSL VPN user
groups on page 42.
Configure the firewall policy and the remaining parameters needed to support the
required mode of operation:
Define SSL VPN event-logging parameters. See Configuring SSL VPN eventlogging on page 50.
You can also monitor active SSL VPN sessions. See Monitoring active SSL VPN
sessions on page 51.
19
20
This takes you to the page with firmware images for MR7.
21
To run the SSL VPN Virtual Desktop application, select Start > All Programs >
FortiNet > SSL VPN Virtual Desktop > SSL VPN Virtual Desktop.
The FortiGate unit may offer you a self-signed security certificate. If you are
prompted to proceed, select Yes.
22
When you are prompted for your user name and password:
Select Login.
The FortiGate unit will redirect your web browser to the FortiGate SSL VPN
Remote Access Web Portal home page automatically.
The fields in the Tools area enable you to specify the URL or IP address of a host
computer. If required, you can ping a host computer behind the FortiGate unit to
verify connectivity to that host.
To connect to a web server from the Tools area
1
In the Connect to Web Server field, type the URL of the web server (for example,
http://www.mywebexample.com or https://172.20.120.101).
Select Go.
The FortiGate unit replaces the URL with
https://<FG_IP_address>:<port_no>/proxy/http/<specified_URL> and
the requested page is displayed.
In the Test for Reachability (Ping) field, type the IP address of the host or server
that you want to reach (for example, 192.168.12.22).
Select Go.
A message stating whether the IP address can be reached or not is displayed.
23
24
This takes you to the page with firmware images for MR7.
25
Go to Start > All Programs > Fortinet > FortiClient SSL VPN >
FortiClient SSL VPN.
Server Address
Username
Password
Expand button
Client Certificate
Save user name and Select to save the value in Username and Password for future
logins.
password
Keep connection
alive until manually
stopped
Select Connect.
26
27
This takes you to the page with firmware images for MR7.
28
29
Go to the folder that you downloaded the Linux tunnel client application into, and
double-click on forticlientsslvpn.
Server
User
Password
Advanced settings
Save user name
and password
Select to save the value in User and Password for future logins.
Keep connection
Select to have the connection stay up until you log out.
alive until manually
stopped
30
Use Client
File Path
Certificate (A PKCS
#12 File)
File Password
Use Proxy
Proxy
Enter the IP address of the proxy server and the port identifier.
User
Enter the user name of the client using the proxy server.
Password
Enter the user password for the client to access the proxy server.
Connect
31
This takes you to the page with firmware images for MR7.
To download the SSL VPN MacOS client application, double-click on the client file
forticlientsslvpn_macosx_3.0.384.dmg.
The Mac mounts the disk image as forticlientsslvpn.
Double-click the forticlientsslvpn.pkg file inside the disk image and follow the
instructions.
The application installs the program forticlientsslvpn in the Applications
folder
32
33
The FortiGate unit redirects web browsers to the web portal home page after
the remote client has been authenticated and the user has logged in
successfully. As an option, you can display a second HTML page in a popup
window for all members of a user group. For more information, see
Redirecting a user group to a popup window on page 40.
You can customize the look of the web portal login page through replacement
messages. For more information, see Customizing the web portal login page
on page 41.
34
Tunnel IP Range
Specify the range of IP addresses reserved for tunnelmode SSL VPN clients. Type the starting and ending
address that defines the range of reserved IP
addresses. See Specifying an IP address range for
tunnel-mode clients.
Server Certificate
Default - RC4(128
bits) and higher
High - AES(128/256
bits) and 3DES
35
Idle Timeout
Portal Message
Advanced (DNS and WINS Servers) See Adding WINS and DNS services for clients.
DNS Server #1
DNS Server #2
WINS Server #1
WINS Server #2
Select Apply.
!
36
Caution: Take care to prevent overlapping IP addresses. Do not assign IP addresses that
are already in use on the private network. As a precaution, consider assigning IP
addresses from a network that is not commonly used (for example, 10.254.254.0/24).
In the Tunnel IP Range fields, type the starting and ending IP addresses (for
example, 10.254.254.80 to 10.254.254.100).
Select Apply.
If the web browser on the remote client is capable of matching a high level of
SSL encryption, select High - AES(128/256 bits) and 3DES. This option
enables cipher suites that use more than 128 bits to encrypt data.
If you are not sure which level of SSL encryption the remote client web
browser supports, select Low - RC4(64 bits), DES and higher. The web
browser must at least support a 64-bit cipher length.
Select Apply.
In the Idle Timeout field, type an integer value. The valid range is from 10 to
28800 seconds.
Select Apply.
37
Note: The default value is 1500 seconds. You can only modify this timeout value in the CLI.
For example, to change the authentication timeout to 1800 seconds, enter the
following commands:
config vpn ssl settings
set auth-timeout 1800
end
Select Apply.
Enter the IP addresses of one or two DNS Servers to be provided for the use of
clients.
Enter the IP addresses of one or two WINS Servers to be provided for the use of
clients.
38
Select the Edit icon in the row that corresponds to the SSL VPN user group.
In the Redirect URL field, type the URL of the web page that you want to display in
the popup window.
Select OK.
Expand the SSL VPN row and select the Edit icon that corresponds to the SSL
VPN login message.
Edit the HTML text, subject to the restrictions given in the FortiGate Administration
Guide (see Changing the authentication login page in the System Config
chapter).
Select OK.
39
You can choose to use a plain text password for authentication through the
FortiGate unit (Local domain), forward authentication requests to an external
RADIUS or LDAP server, or utilize PKI certificate authentication. If password
protection will be provided through a RADIUS or LDAP server, you must configure
the FortiGate unit to forward authentication requests to the RADIUS or LDAP
server. In the case of certificate authentication, you must install the required
certificates.
The following procedures explain how to create a user account and user group in
the Local domain. For information about how to create RADIUS, LDAP or PKI
user accounts, refer to the User chapter of the FortiGate Administration Guide.
For information about certificate authentication, see the FortiGate Certificate
Management User Guide.
To create a user account in the Local domain
1
40
User Name
Disable
Password
LDAP
RADIUS
Select OK.
In the Name field, type a name for the group (for example, Web-only_group).
One at a time, select user names from the Available Users/Groups list, and select
the right-pointing arrow to move them to the Members list.
Select the blue triangle to expand the SSL-VPN User Group Options.
Select Enable SSL-VPN Tunnel Service if the remote clients associated with the
user group need to establish an SSL VPN tunnel with the FortiGate unit.
Note: If a user has been configured to use tunnel-mode only, when they log in, the tunnel is
brought up automatically. The split tunneling feature is not activated by default, it must be
selected.
41
To activate the split tunnel feature, select Enable Split Tunneling. Split tunneling
ensures that only the traffic for the private network is sent to the SSL VPN
gateway. Internet traffic is sent through the usual unencrypted route.
To override the Tunnel IP range defined in VPN > SSL > Config, enter the starting
and ending IP address range for this group in the Restrict tunnel IP range for this
group fields.
Note: If you configure a user group and define Restrict tunnel IP range for this group, the
group range is used in the SSL VPN configuration. If you do not define a range of global IP
addresses, you must define a group range. If you define both IP address ranges, the group
level range is applied to the configuration.
10
If the user group requires web-only-mode access, select Enable Web Application
and then select the web applications and/or network file services that the user
group needs. The corresponding server applications can be running on the
network behind the FortiGate unit or accessed remotely through the Internet.
To enable client-integrity checking options, select from the following:
If there are no applications installed and enabled on the client computer, the
connection is refused. Table 1 lists the products supported for clients who have
Windows XP SP2. All other systems must have Norton (Symantec) AntiVirus or
McAfee VirusScan software installed and enabled.
42
AV
Firewall
McAfee
Sophos Anti-Virus
F-Secure
Secure Resolutions
AhnLab
Kaspersky
ZoneAlarm
Require Virtual Desktop Connection prevents a user from establishing a SSL VPN
session without using the SSL VPN Virtual Desktop application. For more
information, see the SSL VPN User Guide.
11
To enable the FortiGate unit to remove residual information from the remote client
computer (for example, from the web browser cache) just before the SSL VPN
session ends, select Enable Cache Clean. When this feature is enabled, if the
clients browser cannot install and run the cache cleaner, the user is not allowed to
access the SSL-VPN portal.
12
To allow the SSL VPN user group to use a pre-configured bookmark group,
enable Bookmarks and select the bookmark group from the drop-down list.
13
To have the FortiGate unit display a second HTML page in a popup window when
the web portal home page is displayed, type the URL of the web page into the
Redirect URL field.
14
To display a custom web portal home page caption for this group, enter the
message in the Customize portal message for this group field.
Note: This custom message overrides the portal message configured in VPN >
SSL > Config.
15
Select OK.
43
specifying the level of SSL encryption to use and the authentication method
Note: In tunnel mode, it is necessary to create a DENY firewall policy that immediately
follows the SSL VPN policy. If this policy is not created, SSL VPN tunnels will use other
ACCEPT firewall policies. See the order of the Firewall policies below:
For the source address, select the predefined address all in the firewall
encryption policy to refer to web-only mode clients.
The destination address corresponds to the IP address or addresses that
remote clients need to access. The destination address may correspond to
an entire private network (behind the FortiGate unit), a range of private IP
addresses, or the private IP address of a server or host.
Tunnel mode:
44
In the Address Name field, type a name that represents the local network,
server(s), or host(s) to which IP packets may be delivered (for example,
Subnet_1).
In the Subnet/IP Range field, type the corresponding IP address and subnet mask
(for example, 172.16.10.0/24).
Note: To provide access to a single host or server, you would type an IP address like
172.16.10.2/32. To provide access to two servers having contiguous IP addresses, you
would type an IP address range like 172.16.10.[4-5].
Select OK.
To define the firewall policy for web-only mode connections
Interface/Zone
Select the FortiGate interface that accepts connections from remote
users.
Address Name
Select all.
Destination
Interface/Zone
Select the FortiGate interface to the local private network (for example,
dmz).
Address Name
Select the IP destination address that you defined previously (for
example, Subnet_1).
Service
Select ANY.
Action
Select SSL-VPN.
SSL Client
Certificate
Restrictive
Cipher Strength Select one of the following options to determine the level of SSL
encryption to use. The web browser on the remote client must be
capable of matching the level that you select:
To use any cipher suite, select Any.
To use a 164-bit or greater cipher suite, select High >= 164.
To use a 128-bit or greater cipher suite, select Medium >= 128.
User
Authentication
Method
Available
Groups
Select the name of the user group requiring SSL VPN access, and then
select the right-pointing arrow. Do not select more than one user group
unless all members of the selected user groups have identical access
requirements.
Select OK.
If the user group requires access to another server or network, create the IP
destination address (see To specify the destination IP address on page 46) and
repeat this procedure to create the required firewall policy.
45
After the user adds the ActiveX plugin to the web browser on the remote client, the
user can start the SSL VPN client software to initiate an SSL VPN tunnel with the
FortiGate unit. The FortiGate unit establishes the tunnel with the SSL client and
assigns the client a virtual IP address. Afterward, the SSL client uses the assigned
virtual IP address as its source address for the duration of the session.
To configure the FortiGate unit to support tunnel-mode access, you perform the
following configuration tasks on the FortiGate unit:
Specify the IP address(es) that can be assigned to the SSL VPN client when
they establish tunnels with the FortiGate unit.
A firewall policy specifies the originating (source) IP address of a packet and the
destination address defines the IP address of the intended recipient or network. In
this case, the source address corresponds to the IP address of the remote user
that will connect to the FortiGate unit, and the destination address corresponds to
the IP address(es) of the host(s), server(s), or network behind the FortiGate unit.
Configuring the firewall policy involves:
specifying the level of SSL encryption to use and the authentication method
Note: If your destination address, SSL encryption, and user group are the same
as for your web-only mode connection, you do not need to create a firewall policy
for tunnel mode. The FortiGate unit uses the web-only mode policy settings
except for the source address range, which it obtains from the tunnel IP range
settings.
To specify the source IP address
46
In the Address Name field, type a name that represents the IP address that is
permitted to set up SSL VPN connection.
FortiOS v3.0 MR7 SSL VPN User Guide
01-30007-0348-20080718
In the Subnet/IP Range field, type the corresponding IP address and subnet mask
(for example, 172.16.10.0/24). If the remote clients IP address is unknown,
the Subnet/IP Range should be all, with 0.0.0.0/0.0.0.0 as the address used.
Note: To provide access to a single host or server, you would type an IP address like
172.16.10.2/32. To provide access to two servers having contiguous IP addresses, you
would type an IP address range like 172.16.10.[4-5].
In the Interface field, select the interface to the internal (private) network.
Select OK.
In the Address Name field, type a name that represents the local network,
server(s), or host(s) to which IP packets may be delivered (for example,
Subnet_2).
In the Subnet/IP Range field, type the corresponding IP address (for example,
192.168.22.0/24 for a subnet, or 192.168.22.2/32 for a server or host), or
IP address range (192.168.22.[10-25]).
In the Interface field, select the interface to the external (public) network.
Select OK.
To define the firewall policy for tunnel-mode operations
Interface/Zone
Select the FortiGate interface that accepts connections from
remote users (for example, external).
Address Name
Select the name that corresponds to the IP address of the remote
user.
Destination
Interface/Zone
Select the FortiGate interface to the local private network (for
example, internal).
Address Name
Select the IP destination address that you defined previously for
the host(s), server(s), or network behind the FortiGate unit (for
example, Subnet_2).
Service
Select ANY.
Action
Select SSL-VPN.
SSL Client Certificate Select to allow traffic generated by holders of a (shared) group
certificate, for example, a user group containing PKI peers/users.
Restrictive
The holders of the group certificate must be members of an SSL
VPN user group, and the name of that user group must be present
in the Allowed field.
47
Cipher Strength
User Authentication
Method
Available Groups
Select the name of the user group requiring SSL VPN access, and
then select the right-pointing arrow. Do not select more than one
user group unless all members of the selected user groups have
identical access requirements.
Select OK.
Note: If you apply a protection profile in a SSL VPN firewall policy, it will only apply to
tunnel-mode operations.
If the user group requires access to another server or network, create the IP
destination address (see To specify the destination IP address on page 46) and
repeat this procedure to create the required firewall policy.
Create additional IP destination addresses and firewall policies if required for each
additional user group.
Enable the storage of log messages to one or more of the following locations:
a FortiAnalyzer unit
Note: If available on your FortiGate unit, you can enable the storage of log messages to a
system hard disk. In addition, as an alternative to the options listed above, you may choose
to forward log messages to a remote computer running a WebTrends firewall reporting
server. For more information about enabling either of these options through CLI commands,
see the log chapter of the FortiGate CLI Reference.
48
If the options are concealed, select the blue arrow beside each option to reveal
and configure associated settings.
If logs will be written to system memory, from the Log Level list, select Information.
For more information, see the Log & Report chapter of the FortiGate
Administration Guide.
Select Apply.
To filter SSL VPN events
Select Enable, and then select one or more of the following options:
Select Apply.
To view SSL VPN event logs
If the option is available from the Type list, select the log file from disk or memory.
You can modify the settings in the top row to meet your requirements. Log
messages are displayed beneath the top row.
No.
User
Source IP
Begin Time
Description
49
Delete
If required, you can end a session/connection by selecting the Delete button in the
row that corresponds to the connection.
Delete Edit
Bookmark Name The type/names of links to remote server applications and network
services.
Link
See also
50
Bookmark Name Type the text to display in the hyperlink. The name is displayed in the
Bookmarks list.
Application Type Select the abbreviated name of the server application or network
service from the drop-down list:
Web
Telnet
FTP
SMB/CIFS
VNC
RDP
SSH
URL/Host/Folder Type the information that the FortiGate unit needs to forward client
requests to the correct server application or network service:
If the application type is Web, type the URL of the web server (for
example, www.fortinet.com).
If the application type is Telnet, type the IP address of the telnet
host (for example, 10.10.10.10).
If the application type is FTP, type the IP address of the FTP host
as a root directory/folder (for example, //server/folder/).
If the application type is SMB/CIFS, type the IP address of the SMB
host and the root directory/folder associated with your account (for
example, //server/folder/).
If the application type is VNC, type the IP address of the host (for
example, 10.10.10.10).
If the application type is RDP, type the IP address of the RDP host
(for example, 10.10.10.10).
If the application type is SSH, type the IP address of the SSH host
(for example, 10.10.10.10).
See also
51
Group Name
Bookmarks
See also
52
Name
Type the name of the bookmark group. The name is displayed in the
Bookmark Group list, and is a selection in the Bookmarks list in an SSL
VPN user group.
Available
Bookmarks
Used Bookmarks The list of bookmarks that belong to the bookmark group.
Right arrow
button
Left arrow button Remove a bookmark from the Used Bookmarks list.
Select a bookmark in the Used Bookmarks list and select the left arrow
button to move it to the Available Bookmarks list.
Create New...
See also
53
Description
set sslvpn-os-check
{disable | enable}
set latest-patch-level
{disable | 0 - 255}
set tolerance
{tolerance_num}
Configuration Example
The following configuration allows a Windows 2000 user with patch level 2
(latest-patch-level minus tolerance) and above permission to access SSL
VPN services, as well as any Windows XP users.
config vpn ssl settings
set sslvpn-enable enable
set tunnel-endip 10.1.1.10
set tunnel-startip 10.1.1.1
end
config user group
edit "g1"
set group-type sslvpn
set sslvpn-tunnel enable
set sslvpn-tunnel-startip 10.1.1.1
set sslvpn-tunnel-endip 10.1.1.10
set sslvpn-webapp enable
set sslvpn-os-check enable
config sslvpn-os-check-list "windows-2000"
set action check-up-to-date
set latest-patch-level 3
54
Granting unique access permissions for SSL VPN tunnel user groups
set tolerance 1
end
config sslvpn-os-check-list "windows-xp"
set action allow
end
set member "u1"
set sslvpn-split-tunneling enable
set sslvpn-http enable
next
end
config firewall policy
edit 1
set srcintf "internal"
set dstintf "external"
set srcaddr "all"
set dstaddr "172.18.8.0/24"
set action ssl-vpn
set schedule "always"
set service "ANY"
set groups "g1"
next
end
55
Granting unique access permissions for SSL VPN tunnel user groups
Sample configuration for unique access permissions with tunnel mode user
groups
In this sample configuration, there are two user groups, each one with a dedicated
IP address range.
Note: The source address for both SSL VPN firewall policies can be left as all when the
users do not have static public IPs.
After enabling SSL VPN, you must create the users and then the user groups that
require SSL VPN tunnel mode access.
Go to User > Local and create user1 and user2 with password authentication.
Note: user1 only has permission to access the Linux server, while user2 only has
permission to access the Windows PC.
After you create the users, you must create the SSL VPN user groups. In order to
configure each user with different access permissions, you must create separate
user groups and designate specific IP ranges for each group.
56
Granting unique access permissions for SSL VPN tunnel user groups
Go to User > User Group. Create group1 as an SSL VPN user group with user1
as the member and 10.1.1.1 - 10.1.1.50 as the values in Restrict tunnel IP range
for this group.
Figure 15: group1 user group attributes
Create group2 as an SSL VPN user group with user2 as the member and
10.1.1.51 - 10.1.1.100 as the values in Restrict tunnel IP range for this group.
Figure 16: group2 user group attributes
After you create the user groups, you need to define the firewall policies to
support tunnel-mode operations.
The firewall policy specifies the originating (source) IP address of a packet and
the destination address that defines the IP address of the intended recipient or
network. In this configuration, the source address corresponds to the public IP
address that can connect to the FortiGate unit, and the destination address
corresponds to the IP address of the Linux server/Windows PC behind the
FortiGate unit.
Before you create the firewall policy, you must define the source and destination
addresses to include in the policy.
Go to Firewall > Address to create the source and destination addresses to
specify in the firewall policies.
57
Granting unique access permissions for SSL VPN tunnel user groups
After creating the source and destination addresses, go to Firewall > Policy to
create the firewall policies.
The policy for user1 is an SSL-VPN firewall policy that includes the applicable
source and destination addresses, and has group1 as the user group attached to
the policy.
58
Granting unique access permissions for SSL VPN tunnel user groups
The user2 policy is also an SSL-VPN firewall policy that includes the applicable
source and destination addresses, and has group2 as the user group attached to
the policy.
Figure 20: user2 firewall policy
59
To avoid overlap with other firewall policies, add a DENY policy below the SSL
VPN policies (the source is the SSL VPN tunnel IP range). See Configuring
firewall policies for more information.
External > Internal, with the action set to SSL, with an SSL user group
This also requires a new static route and should appear as follows:
If you are configuring Internet access through an SSL VPN tunnel, the following
configuration must be added:
60
ssl.root > External, with the action set to Accept, with NAT enabled
Go to Firewall > Policy and select Create New to create a firewall policy.
For a standard configuration, set up the firewall policies listed below.
Authentication policy
Source
wan1
Source address
all
Destination
internal
Destination address
internal subnet
Action
sslvpn
Authentication
ssl.root
Source address
Destination
internal
Destination address
internal subnet
Action
accept
Authentication
No authentication set
Outbound policy
Source
internal
Source address
internal subnet
Destination
ssl.root
Destination address
Action
Accept
Authentication
No authentication set
Static route
Destination network
<ssl-assigned subnet>
To allow ssl users to browse the Internet through the FortiGate unit:
Internet browsing policy
Source
ssl.root
Source address
ssl-assigned range
Destination
wan1
Destination address
all
Action
accept
NAT enabled
Yes
Protection profile
Recommended
ssl.root
Source address
ssl-assigned range
61
Destination
wan1
Destination address
Action
ipsec
VPN tunnel
Note: This CLI command is only available in FortiOS 3.00 MR4 and higher.
62
63
64
Tunnel-mode features
Logging out
URL re-writing
Using the web browser on your computer, browse to the URL of the FortiGate unit
(for example, https://<FortiGate_IP_address>:10443/remote).
The FortiGate unit may offer you a self-signed security certificate. If you are
prompted to proceed, select Yes.
A second message may be displayed to inform you that the FortiGate certificate
distinguished name differs from the original request. This message is displayed
because the FortiGate unit is attempting to redirect your web browser connection.
You can ignore the message.
65
When you are prompted for your user name and password:
Select Login.
The FortiGate unit will redirect your web browser to the FortiGate SSL VPN
Remote Access Web Portal home page automatically.
66
Figure 22: FortiGate SSL VPN Remote Access Web Portal page
Logout
Help
Delete
Edit
If your user account permits web-only mode access, and your administrator has
set up pre-defined bookmarks for you, they will appear in a list under Pre-defined
Bookmarks. You can start any session from these hyperlinks, but you cannot
change them. Also, you can create your own hyperlinks to frequently accessed
server applications and start any session from the home page through these
hyperlinks. See Launching web portal applications and Adding a bookmark to
the My Bookmarks list.
If your user account permits tunnel-mode connections, you can install/uninstall
Fortinet SSL VPN client software and/or initiate an SSL VPN tunnel with the
FortiGate unit. Selecting the Activate SSL-VPN Tunnel Mode link at the top of the
home page displays the Fortinet SSL VPN Client area. See Tunnel-mode
features.
67
In the Tools area, you can connect to a web server or start a telnet session. You
can also check connectivity to a host or server on the network behind the
FortiGate unit. For more information, see Starting a session from the Tools area.
Telnet servers (TCP/IP Terminal Emulation Protocol) enable you to use your
computer as a virtual terminal to log in to a remote host.
FTP (File Transfer Protocol) servers enable you to transfer files between your
computer and a remote host.
SSH (Secure Shell) servers enable you to exchange data between two
computers using a secure channel.
Note: Windows file sharing through SMB/CIFS is supported through shared directories.
When you access any of these server applications, the server may prompt you for
a user name and password. To log in, you must have a user account created by
the server administrator.
URL re-writing
When a FortiGate unit forwards client requests to servers on the Internet or
internal network, there may be a requirement to access a site with a name or
address that should not be exposed. For HTTP/HTTPS, the FortiGate unit
employs an obfuscation technique that encrypts the hostname with a random key
using AES-128, then the corresponding hex value plus Z is added at the
beginning to form the encoded name.
For example, in the case of the URL http://test.org/index.html, the FortiGate unit
would translate to the following:
https://<sslvpn_host:port>/proxy/http/Z<encrypted hex value>/index.html
68
The encryption key is only valid for the current user session. Once the user logs
out, the key is no longer valid.
In the case of FTP and SMB, the path/filename is translated into its hex value for
internal encoding purposes. The actual host ip is displayed. Other protocols are
not supported.
The CLI command related to the obfuscation technique is url-obscuration in
config vpn ssl settings.
Delete
Edit
Add Bookmark
Create a hyperlink.
Bookmark
Details
69
Title
Application Type
URL,
Host Name/IP, or
Shared File Folder
Telnet
FTP
SMB/CIFS
VNC
RDP
SSH
Type the information that the FortiGate unit needs to forward client
requests to the correct server application or network service:
If the application type is Web, type the URL of the web server
(for example, http://www.google.com or
https://172.20.120.101).
70
In the URL field, type the URL of the web server (for example,
http://www.mywebexample.com or https://172.20.120.101).
Select OK.
To connect to the web server, select the hyperlink that you created.
In the Host Name/IP field, type the IP address of the telnet host (for example,
10.10.10.10).
Select OK.
Select Connect.
A telnet session starts and you are prompted to log in to the remote host. You
must have a user account to log in. After you log in, you may enter any series of
valid telnet commands at the system prompt.
71
To end the session, select Disconnect (or type exit) and then close the TELNET
connection window.
To add an FTP connection and start an FTP session
72
In the Shared File Folder field, type the IP address of the FTP host as a root
directory (for example, //10.10.10.10/).
Select OK.
To start the ftp session, select the hyperlink that you created.
When you are prompted to log in to the remote host, type your user name and
password. You must have a user account on the remote host to log in.
Select Login.
After you log in, the files and subdirectories in the root directory are displayed.
You can switch to a subdirectory from the root directory. For example, the
following image shows the contents of a subdirectory named share.
New Directory
Logout
Delete
Rename
The view enables you to navigate through the file system and manipulate files in
the following ways:
To download a file from the current directory, select the file link in the Name
column.
To upload a file from the remote directory to the current directory on your client
computer, select the file link in the Name column.
When the current directory is a subdirectory, you can select Up to switch to the
parent directory.
In the Shared File Folder field, type the IP address of the SMB host and the root
directory associated with your account (for example, //10.10.10.10/share/).
73
Select OK.
When you are prompted to log in to the remote host, type your user name and
password. You must have a user account on the remote host to log in.
Select Login.
After you log in, the root directory associated with your user or group account is
displayed. For example, in the figure below, the files and subdirectories in the root
directory share are displayed.
New Directory
Logout
Delete
Rename
The view enables you to navigate through the file system and manipulate files in
the following ways:
74
To download a file from the current directory, select the file link in the Name
column.
To upload a file from the remote directory to the current directory on your client
computer, select the file link in the Name column.
When the current directory is a subdirectory, you can select Up to switch to the
parent directory.
In the Host Name/IP field, type the IP address of the VNC host (for example,
10.10.10.10/).
Select OK.
When you are prompted to log in to the remote host, type your user name and
password. You must have a user account on the remote host to log in.
Select OK.
75
76
da: Danish
de: German
en-us: English, US
es: Spanish
fi: Finnish
fr: French
hr: Croatian
it: Italian
ja: Japanese
lt: Lithuanian
lv: Latvian
mk: Macedonian
no: Norwegian
pl: Polish
pt: Portuguese
ru: Russian
sl: Slovenian
sv: Sudanese
tk: Turkmen
tr: Turkish
In the Shared File Folder field, type the IP address of the RDP host (for example,
10.10.10.10).
Select OK.
FortiOS v3.0 MR7 SSL VPN User Guide
01-30007-0348-20080718
When you are prompted to log in to the remote host, type your user name and
password. You must have a user account on the remote host to log in.
Select Login.
10
77
In the Host Name/IP field, type the IP address of the SSH host (for example,
192.168.1.3).
Select OK.
78
Select Connect.
A SSH session starts and you are prompted to log in to the remote host. You must
have a user account to log in. After you log in, you may enter any series of valid
commands at the system prompt.
To end the session, select Disconnect (or type exit) and then close the SSH
connection window.
See also
Tunnel-mode features
Logging out
URL re-writing
79
In the Connect to Web Server field, type the URL of the web server (for example,
http://www.mywebexample.com or https://172.20.120.101).
Select Go.
The FortiGate unit replaces the URL with
https://<FG_IP_address>:<port_no>/proxy/http/<specified_URL> and
the requested page is displayed.
In the Test for Reachability (Ping) field, type the IP address of the host or server
that you want to reach (for example, 192.168.12.22).
Select Go.
A message stating whether the IP address can be reached or not is displayed.
To start a telnet session from the Tools area
In the Telnet to Host field, type the IP address of the telnet host (for example,
192.168.5.238).
Select Go.
Note: The FortiGate unit may offer you its self-signed security certificate. Select Yes to
proceed. A second message may be displayed to inform you of a host name mismatch.
This message is displayed because the FortiGate unit is attempting to redirect your web
browser connection. Select Yes to proceed.
Select Connect.
A telnet session starts and you are prompted to log in to the remote host. You
must have a user account to log in. After you log in, you may enter any series of
valid telnet commands at the system prompt.
To end the session, select Disconnect (or type exit) and then close the TELNET
connection window.
Tunnel-mode features
The FortiGate SSL VPN Remote Access Web Portal page is displayed after you
log in. Selecting the Activate SSL-VPN Tunnel Mode link at the top of the home
page displays the Fortinet SSL VPN Client area.
If your user account permits tunnel-mode connections, you can install/uninstall
SSL VPN client software and/or initiate an SSL VPN tunnel with the FortiGate unit.
(see Figure 25)For more information, see Working with the ActiveX/Java Platform
plug-in.
80
Tunnel-mode features
Figure 25: Fortinet SSL VPN Client 1.0 page (tunnel mode)
Link Status
Bytes Sent
Bytes Received
Install
Download the SSL VPN client software from the FortiGate unit
and add the ActiveX/Java Platform plugin to the local web
browser.
Uninstall
Connect
Disconnect
End the session and close the tunnel to the FortiGate unit.
Refresh Now
81
Tunnel-mode features
At the top of the web portal home page, select the Activate SSL-VPN Tunnel
Mode link.
The FortiGate unit may prompt you to install a Fortinet SSL VPN Client plugin.
Follow the instructions provided to install ActiveX or Java Platform.
Note: With Windows XP Service Pack 2, a yellow bar is displayed at the top of the screen.
You must click on the bar (accept) and follow the instructions to install the ActiveX control.
Select Install.
To initiate a VPN tunnel with the FortiGate unit
The IP address of the public FortiGate interface and the TCP port number through
which SSL VPN connections are made are displayed in the Server IP field of the
Fortinet SSL VPN Client page.
At the top of the web portal home page, select the Activate SSL-VPN Tunnel
Mode link.
82
Logging out
Select Connect.
Figure 26: Tunnel established
After the Fortinet SSL VPN client connected to server message is displayed and
the Disconnect button is enabled (see Figure 26), you have direct access to the
network behind the FortiGate unit, subject to the conditions of the FortiGate
firewall policy. For example, using a client application on your computer, you could
connect to a server application on the network behind the FortiGate unit and
download information.
To stop the SSL VPN session and disconnect from the FortiGate unit, select
Disconnect. You must log out from the web portal to disconnect from the FortiGate
unit (see Logging out). You can use the Connect button to re-establish the
tunnel.
At the top of the web portal home page, select the Activate SSL-VPN Tunnel
Mode link.
Select Uninstall.
Logging out
To log out from the web portal, select the Logout button in the top right corner of
the web portal home page.
Logout
83
Logging out
84
Index
Index
A
ActiveX plugin
downloading 81
uninstalling 83
applications, web-portal 68
authentication timeout setting 40
documentation
commenting on 12
Fortinet 9
downloading
Linux client 28
MacOS client 32
Windows client 25
bookmarks
user-defined 69
C
certificates
allow group certificate 47
self signed 65
X.509 20
cifs session, establishing 73
cipher suite, SSL negotiations 39
client
Linux 28
MacOS 32
standalone 24
uninstalling Linux 32
uninstalling MacOS 35
uninstalling Windows 27
using Linux 31
using MacOS 34
using Windows 27
Windows 25
client requirements
tunnel mode 18
web-only mode 16
comments, documentation 12
configuration, general steps 20
configuring
SSL VPN client 20
connecting
to ftp server 72
to secure HTTP gateway 65
to telnet server 71, 78, 80
to web portal 66
to web server 24, 70, 80
to web-based manager 36
connections
defining bookmarks to 69
enabling SSL VPN 36
connectivity, testing for 24, 80
customer service 12
D
deployment topology 19
F
firewall policy
tunnel-mode access 48
web-only mode access 46
FortiGate documentation
commenting on 12
Fortinet customer service 12
Fortinet documentation 9
Fortinet Knowledge Center 11
Fortinet SSL VPN Client area 80, 82
ftp server, connecting to 72
ftp session, establishing 72
H
home page, web portal features 66
host check
OS 56
host OS
patch check 56
I
idle timeout setting 40
infrastructure requirements 19
overall 19
tunnel-mode clients 18
web-only mode clients 16
introduction
deployment topology 18
FortiGate SSL VPN technology 7
Fortinet documentation 9
general configuration steps 20
tunnel mode 7
web-only mode 7
IP address range, tunnel mode 38
IPSec VPN
comparison to SSL 13
85
Index
K
keyboard setting, rdp 76
L
logging
filtering SSL VPN events 51
setting event-logging parameters 50
viewing SSL VPN event logs 51
logging in
to FortiGate secure HTTP gateway 65
logging out
from web portal page 83
M
modes of operation 7, 15
tunnel mode 17
web-only mode 15
My Bookmarks list 69
N
network configuration 19
recommended 18
O
obfuscation 68
OS
host patch check 56
P
patch check
host OS 56
ping host from remote client 24, 80
port number
for web-portal connections 38
R
rdp keyboard setting 76
rdp session, establishing 76
redirection, to popup window 40
replacement message, to customize web portal login
page 41
S
security certificate
allow group certificate 47
sessions, monitoring 51
smb session, establishing 73
split tunneling 7
SSL VPN
bookmark 52
bookmark group 54
checking client certificates 37
comparison to IPSec VPN 13
configuration overview 20
configuring client 20
deployment topology 18
downloading client software 81
86
T
technical support 12
telnet server, connecting to 71, 78, 80
telnet session, starting 71, 78
Tools area 68, 80
tunnel mode 17
client requirements 18
configuring FortiGate server 48
firewall policy for 48
Fortinet SSL VPN Client area 80, 82
introduction 7
IP address range 38
user group, unique access permissions 57
web portal features 80
tunnel, initiating 82
U
unique access permissions
configuring user groups 57
granting 57
SSL VPN tunnel mode 57
URL
for user log in 65
URL obfuscation 68
URL re-writing 68
user accounts, creating 42
user groups
configuring SSL VPN tunnel-mode 57
creating unique access permissions 57
user groups, creating 42
Index
V
Virtual Desktop 21
downloading 21
running 21
using 21
vnc session, establishing 75
VPN tunnel, initiating 82
W
web portal 69
adding caption to home page 40
applications 68
customizing login page 41
Fortinet SSL VPN Client area 80, 82
home page features 66
X
X.509 security certificates 39
87
Index
88
www.fortinet.com
www.fortinet.com